Getting Data In

perfmon no longer working?

twinspop
Influencer

Installed via command line with:

msiexec /I splunk...msi /qn ALLUSERS=1 REBOOT=ReallySuppress AGREETOLICENSE=Yes RECEIVING_INDEXER="indexer:7900"

myapp/defaults/inputs.conf:

[monitor://C:\WINNT\system32\LogFiles\HTTPERR]
disabled = false
sourcetype = iishttperr
ignoreOlderThan = 3d

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = false

myapp/defaults/perfmon.conf:

[PERFMON:Web Stats]
counters = Total Connection Attempts;Total Method Requests;Total Bytes Sent
disabled = false
instances = _Total
interval = 300
object = Web Service

Splunkd.log says:

06-02-2011 15:25:15.893 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Web Service(*)\Total Connection Attempts'  error 0xc0000bb9
06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" splunk-regmon - No enabled entries were found in the conf files.
06-02-2011 15:25:18.268 -0700 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "C:\Program Files\SplunkUniversalForwarder\bin"" Using logging configuration at C:\Program Files\SplunkUniversalForwarder\etc\log-cmdline.cfg.
0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

I'm no perfmon expert, but that error is:
0xC0000BB9 (PDH_CSTATUS_NO_COUNTER) The specified counter could not be found.

So, I'd imagine that your "Total Connection Attempts" counter isn't valid or isn't enabled. Maybe "Attempts" should be "attempts" (based on a some Googling and a little faith)?

View solution in original post

mw
Splunk Employee
Splunk Employee

I'm no perfmon expert, but that error is:
0xC0000BB9 (PDH_CSTATUS_NO_COUNTER) The specified counter could not be found.

So, I'd imagine that your "Total Connection Attempts" counter isn't valid or isn't enabled. Maybe "Attempts" should be "attempts" (based on a some Googling and a little faith)?

twinspop
Influencer

I was chasing my tail here. Apparently nothing is being logged from this SUF any longer. I saw the lack of perfmon entries first, and that log entry and focused in on that. But no log entries from even the most basic text file are making it to the indexer. Back to the drawing board. Thanks for the help on spotting my bad perfmon entry.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...